WO2024031881A1 - 一种操作行为识别方法及装置 - Google Patents
一种操作行为识别方法及装置 Download PDFInfo
- Publication number
- WO2024031881A1 WO2024031881A1 PCT/CN2022/136238 CN2022136238W WO2024031881A1 WO 2024031881 A1 WO2024031881 A1 WO 2024031881A1 CN 2022136238 W CN2022136238 W CN 2022136238W WO 2024031881 A1 WO2024031881 A1 WO 2024031881A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- behavior
- trained
- image
- risk
- risk score
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 62
- 206010000117 Abnormal behaviour Diseases 0.000 claims abstract description 39
- 238000003860 storage Methods 0.000 claims abstract description 16
- 230000006399 behavior Effects 0.000 claims description 198
- 238000012545 processing Methods 0.000 claims description 30
- 230000008569 process Effects 0.000 claims description 22
- 238000009826 distribution Methods 0.000 claims description 19
- 230000004884 risky behavior Effects 0.000 claims description 17
- 238000012549 training Methods 0.000 claims description 15
- 238000013528 artificial neural network Methods 0.000 claims description 14
- 238000004590 computer program Methods 0.000 claims description 12
- 238000000605 extraction Methods 0.000 claims description 10
- 230000001960 triggered effect Effects 0.000 claims description 5
- 238000013507 mapping Methods 0.000 claims description 4
- 230000002159 abnormal effect Effects 0.000 claims description 2
- 238000012544 monitoring process Methods 0.000 abstract description 9
- 238000013473 artificial intelligence Methods 0.000 abstract description 3
- 239000002699 waste material Substances 0.000 abstract description 3
- 238000010586 diagram Methods 0.000 description 15
- 230000006870 function Effects 0.000 description 8
- 230000005856 abnormality Effects 0.000 description 6
- 230000002452 interceptive effect Effects 0.000 description 5
- 230000009466 transformation Effects 0.000 description 5
- 238000004364 calculation method Methods 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 230000003993 interaction Effects 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 238000003825 pressing Methods 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 230000003542 behavioural effect Effects 0.000 description 1
- 238000013480 data collection Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
- 230000001131 transforming effect Effects 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
- G06V40/20—Movements or behaviour, e.g. gesture recognition
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/40—Extraction of image or video features
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
- G06V10/762—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using clustering, e.g. of similar faces in social networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
- G06V10/764—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using classification, e.g. of video objects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
- G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
- G06V10/774—Generating sets of training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V20/00—Scenes; Scene-specific elements
- G06V20/50—Context or environment of the image
- G06V20/52—Surveillance or monitoring of activities, e.g. for recognising suspicious objects
Definitions
- the present application relates to the field of artificial intelligence technology, and in particular to an operating behavior recognition method and device.
- Embodiments of the present application provide an operation behavior recognition method and device, which are used to improve the efficiency of operation behavior recognition and reduce the resource consumption of operation behavior recognition.
- embodiments of the present application provide an operation behavior recognition method, including:
- the risk judgment result of the current operating behavior is obtained.
- the text description information of the merchant's operating behavior is converted into image information, making the data more intuitive and closer to the monitoring scene, which facilitates the subsequent use of the abnormal behavior recognition model to self-supervise and identify the operating behavior and determine the operating behavior. Whether it is a risky behavior, while improving the accuracy of identification of operational behavior. Secondly, there is no need to preset risky operation behavior policies as a benchmark for identifying whether a merchant's operation behavior is a risky operation behavior, thereby reducing storage resource consumption. Moreover, when the amount of data is large, it can effectively solve the problem of slow calculation caused by the large amount of data and improve the efficiency of operating behavior recognition.
- the text description information of the current operation behavior is obtained by the terminal device through the system application framework layer.
- the text description information includes occurrence time information and location information of the current operation behavior.
- Converting the text description information into an image to be recognized includes:
- the image to be recognized is obtained based on the operation trajectory and the color attribute of each trajectory point.
- the text description information also includes pressure information
- mapping the position information into the two-dimensional space and obtaining the operation trajectory it also includes:
- Determining the image to be recognized based on the operation trajectory and the color attribute of each trajectory point includes:
- the image to be recognized is determined based on the operation trajectory, the color attribute of each trajectory point, and the size of each trajectory point.
- the trained abnormal behavior recognition model includes a trained feature extractor and a trained linear decision model
- the image to be identified is identified through the trained abnormal behavior recognition model, and a preliminary risk score of the multiple dimensions is obtained, including:
- the target image features are judged to obtain preliminary risk scores of the multiple dimensions.
- the trained abnormal behavior recognition model is trained in the following manner:
- the intermediate feature extractor and the linear decision model to be trained are jointly fine-tuned and trained to obtain the trained feature extractor and the trained linear decision model.
- the feature extractor to be trained is trained using a combination of neural network and unsupervised clustering to obtain an intermediate feature extractor, including:
- the feature extractor to be trained is iteratively trained based on the sample image set to obtain an intermediate feature extractor.
- Each iterative training process includes the following steps:
- the distribution loss value is determined, and the distribution loss value is used to adjust the parameters of the feature extractor to be trained through backpropagation.
- the preliminary risk scores in multiple dimensions include a first risk score and a second risk score, wherein the first risk score is used to characterize the abnormality of the current operating behavior; the second risk score is used to characterize It represents the target similarity between the current operation behavior and the historical operation behavior of the target object.
- obtaining the risk judgment result of the current operating behavior based on the preliminary risk scores of the multiple dimensions includes:
- the current operating behavior is determined to be a risky behavior
- the current operation behavior is determined to be a safe behavior.
- the number of times the operation behavior of the target object is determined to be a risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.
- an operating behavior recognition device including:
- An acquisition module used to acquire the text description information of the current operating behavior of the target object, and convert the text description information into an image to be recognized;
- a processing module configured to identify the image to be identified through a trained abnormal behavior recognition model and obtain a preliminary risk score of the current operating behavior in multiple dimensions
- the processing module is also configured to obtain the risk judgment result of the current operating behavior based on the preliminary risk scores of the multiple dimensions.
- the acquisition module is specifically used to:
- the text description information of the current operation behavior is collected by the terminal device through the system application framework layer.
- processing module is specifically used to:
- the image to be recognized is obtained based on the operation trajectory and the color attribute of each trajectory point.
- processing module is specifically used to:
- Determining the image to be recognized based on the operation trajectory and the color attribute of each trajectory point includes:
- the image to be recognized is determined based on the operation trajectory, the color attribute of each trajectory point, and the size of each trajectory point.
- processing module is specifically used to:
- the image to be identified is recognized through the trained abnormal behavior recognition model, and the target risk score corresponding to the current operating behavior is obtained, including:
- the target image features are judged to obtain preliminary risk scores of the multiple dimensions.
- processing module is specifically used to:
- the intermediate feature extractor and the linear decision model to be trained are jointly fine-tuned and trained to obtain the trained feature extractor and the trained linear decision model.
- processing module is specifically used to:
- the feature extractor to be trained is iteratively trained based on the sample image set to obtain an intermediate feature extractor.
- Each iterative training process includes the following steps:
- the distribution loss value is determined, and the distribution loss value is used to adjust the parameters of the feature extractor to be trained through backpropagation.
- processing module is specifically used to:
- the preliminary risk scores of multiple dimensions include a first risk score and a second risk score, where the first risk score is used to characterize the abnormality of the current operating behavior; the second risk score is used to characterize the current The target similarity between the operation behavior and the historical operation behavior of the target object.
- processing module is specifically used to:
- the preliminary risk score based on the multiple dimensions is used to obtain the risk judgment result of the current operating behavior, including:
- the current operating behavior is determined to be a risky behavior
- the current operation behavior is determined to be a safe behavior.
- processing module is specifically used to:
- the number of times the operation behavior of the target object is determined to be a risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.
- embodiments of the present application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor.
- the processor performs any of the operations described in the first aspect. Behavior recognition methods.
- embodiments of the present application provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, it causes the computer device to execute the first aspect. Any described operation behavior recognition method.
- the data is made more intuitive and closer to the monitoring scene, which facilitates the subsequent use of the abnormal behavior recognition model to automatically analyze the operation behavior.
- Supervise the identification to determine whether the operation behavior is a risky behavior and at the same time improve the accuracy of the operation behavior identification.
- Figure 1 is a schematic diagram of a system architecture provided by an embodiment of the present invention.
- Figure 2 is a schematic flowchart of an operation behavior recognition method provided by an embodiment of the present invention.
- Figure 3 is a schematic diagram of the process of converting text description information into an image to be recognized according to an embodiment of the present invention
- Figure 4 is a schematic diagram of a process of constructing an abnormal behavior recognition model provided by an embodiment of the present invention.
- Figure 5 is a schematic structural diagram of an operating behavior recognition device provided by an embodiment of the present invention.
- Figure 6 is a schematic structural diagram of a computing device provided by an embodiment of the present invention.
- the system architecture includes a terminal device 101 and a server 102.
- the terminal device 101 is used to collect text description information of the current operating behavior of the target object.
- the target object may be a merchant, a user, etc.; the terminal device 101 may be a smartphone, a tablet, a laptop, a desktop computer, an automatic teller machine, an acquiring device, etc., but is not limited thereto.
- the server 102 receives the text description information of the current operation behavior sent by the terminal device 101, and determines the risk judgment result of the current operation behavior based on the text description information of the current operation behavior.
- the server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, and network services. , cloud communications, middleware services, domain name services, security services, content delivery network (Content Delivery Network, CDN), and the cloud server side of basic cloud computing services such as big data and artificial intelligence platforms.
- the terminal device 101 and the server 102 can be connected directly or indirectly through wired or wireless communication methods, which is not limited in this application.
- Figure 2 exemplarily shows the process of an operation behavior recognition method.
- the process of the method is executed by a computer device.
- the computing and device can be the server shown in Figure 1, which includes the following steps:
- Step S201 obtain the text description information of the current operation behavior of the target object, and convert the text description information into an image to be recognized;
- the target object may be a merchant
- the current operation behavior is the interaction operation currently being performed by the merchant with the terminal device, where the interaction operation includes but is not limited to click, double-click, interaction, etc.
- the text description information is a text sequence describing the interactive operation.
- the server converts the text description information generated by the current operation behavior to obtain the image to be recognized.
- the text description information includes occurrence time information and location information of the current operation behavior. Then the process of converting text description information into an image to be recognized is: mapping the position information into a two-dimensional space to obtain the operation trajectory; based on the occurrence time information, determining the color attribute of each trajectory point in the operation trajectory; based on the operation trajectory and The color attribute of each trajectory point is used to obtain the image to be recognized.
- the merchant triggers multiple interactive operation events on the screen of the terminal device, and the terminal device collects the text description information of the operation behavior corresponding to the interactive operation event.
- Each operation behavior has corresponding occurrence time information and location information.
- the terminal device sends the occurrence time information and location information of each operation behavior to the server.
- the server converts the data format of the occurrence time information and location information to obtain the specific time and location coordinate points.
- the server performs spatial transformation on the obtained position coordinate points to obtain the operation trajectory; it performs spatial transformation on the specific time to obtain the color attribute of each trajectory point on the operation trajectory. Combining the operation trajectory and the color attribute of each operation point on the operation trajectory, a two-dimensional image to be recognized is obtained.
- operational trajectories include points and/or lines. For example, if the merchant's single operation is "click”, the corresponding operation trajectory of the "click” operation in the two-dimensional space is a point; if the merchant's operation is "swipe", then the “slide” operation is in The corresponding operation trajectory in the two-dimensional space is a line, which is composed of countless trajectory points.
- the color attribute is used to characterize the time sequence of the operation trajectory, and the color attribute may be color depth or color type.
- the image to be recognized generated by the server will include a horizontal operation track, which is composed of countless track points.
- the color type of each track point to be red, and the color depth of consecutive track points from right to left gradually becomes lighter, to represent that the merchant's operation behavior is performed from right to left.
- the text description information also includes pressure information. Map the position information into a two-dimensional space. After obtaining the operation trajectory, determine the size of each trajectory point in the operation trajectory based on the pressure information, and then based on the operation trajectory, the color attribute of each trajectory point and the size of each trajectory point, Determine the image to be recognized.
- the pressure information refers to the pressure value of pressing the screen during operation.
- the merchant triggers multiple interactive operation events on the screen of the terminal device, and the terminal device collects the text description information of the operation behavior corresponding to the interactive operation event.
- Each operation behavior has corresponding occurrence time information, location information, and pressure information.
- the terminal device sends the occurrence time information, location information and pressure information of each operation behavior to the server.
- the server converts the data format of the occurrence time information, location information and pressure information to obtain the specific time, location coordinate point and pressing pressure value.
- the server performs spatial transformation on the obtained position coordinate points to obtain the operation trajectory; performs spatial transformation on the specific time to obtain the color attribute of each trajectory point on the operation trajectory; performs spatial transformation on the pressing pressure value to obtain each trajectory on the operation trajectory Point size.
- the size of each track point on the operation track can reflect the merchant's operation. habit.
- the sizes of multiple track points on the operation track can correspond to the thickness of the operation track.
- the image to be recognized generated by the server includes a horizontal operation track, which is red and colored from right to left. Gradually becomes shallower, and the trajectory of this operation is thicker;
- the Merchant B triggers a sliding event from right to left on the screen of the acquiring device, and the image to be recognized generated by the server includes a horizontal operation track.
- the operation track is blue and gradually becomes lighter from right to left. , and the operation trajectory is thin.
- the text description information of the merchant's operating behavior is converted into image information, making the data more intuitive and closer to the monitoring scene, which facilitates the subsequent use of the abnormal behavior recognition model to self-supervise and identify the operating behavior and determine whether the operating behavior is Risk behaviors while improving the accuracy of operational behavior identification.
- the text description information of the current operation behavior is obtained by the terminal device through the system application framework layer.
- the terminal device enables the data collection function by connecting to the relevant interface of the application framework layer.
- the acquiring device automatically collects the text description information of the merchant's current operation behavior, including information about the time when the operation event occurred and the location of the operation click, and then temporarily stores the collected operation information to the acquiring device. memory, and then sends the operation information to the server in the form of a message queue for data parsing and processing.
- the operation behavior data of merchants is collected using the underlying event acquisition method of the Android system, and the data source is focused on the underlying input events.
- This method does not require embedding the sampling software development kit (Software Development Kit, for short) in advance. SDK), you can monitor any operation of the merchant on the device, which has wider applicability.
- This method includes but is not limited to system attribute setting operations, bill acquiring operations, and other App operations, etc., so it has certain feasibility for the engineering implementation of the merchant-side monitoring system.
- Step S202 Recognize the image to be identified through the trained abnormal behavior recognition model, and obtain preliminary risk scores of the current operating behavior in multiple dimensions;
- the two-dimensional image to be identified is input into the abnormal behavior recognition model, and the abnormal behavior recognition model is used to identify the two-dimensional image to be recognized, and a preliminary risk score of the current operating behavior in multiple dimensions is obtained.
- the preliminary risk score of multiple dimensions includes a first risk score and a second risk score, wherein the first risk score is used to characterize the abnormality of the current operating behavior, and the second risk score is used to characterize the current operating behavior.
- the trained abnormal behavior identification model gives a first risk score based on the abnormality degree of the current operating behavior.
- the higher the risk degree the higher the risk score given by the abnormal behavior identification model.
- automated operations, high-frequency repetitive operations, etc. are all operational behaviors with a higher degree of risk, and will be given a higher risk score accordingly.
- the trained abnormal behavior recognition model will also score based on the target similarity between the current operation behavior and the target object's historical operation behavior to obtain a second risk score.
- the higher the target similarity between the current operation behavior and the historical operation behavior the higher the target similarity between the current operation behavior and the historical operation behavior.
- the lower the target similarity between the current operating behavior and the historical operating behavior it means that the current operating behavior may be abnormal, and the lower the second risk score given by the abnormal behavior identification model.
- This abnormal behavior identification model establishes the connection between usage habits and operating behaviors, and can perform longitudinal identification. It can determine whether there are abnormalities in the equipment by analyzing the merchant's equipment usage habits and single operation behaviors, and make full use of the merchant's historical information. The analysis dimension can effectively identify non-personal operations and achieve the purpose of compliance control of targets.
- Step S203 Obtain the risk judgment result of the current operating behavior based on the preliminary risk scores of multiple dimensions.
- the current operating behavior is determined to be a risky operating behavior.
- the current operating behavior is determined to be a safe operating behavior.
- the trained abnormal behavior recognition model includes a trained feature extractor and a trained linear decision model.
- the image to be recognized is recognized and the target risk score corresponding to the current operating behavior is obtained, including:
- the features of the image to be identified are extracted to obtain the target image features; through the trained linear decision model, the target image features are judged to obtain a preliminary risk score in multiple dimensions.
- the abnormal behavior recognition model includes a feature extractor and a linear decision model.
- the feature extractor can extract features from the two-dimensional image to be identified and obtain the target image features.
- the linear decision model corresponds to the specific business scenario and is used to determine and output the preliminary risk score of the current operating behavior in multiple dimensions under the corresponding business scenario.
- the trained abnormal behavior recognition model is trained in the following manner:
- the feature extractor to be trained is trained using a combination of neural network and unsupervised clustering to obtain an intermediate feature extractor. Perform joint fine-tuning training on the intermediate feature extractor and the linear decision model to be trained to obtain a trained feature extractor and a trained linear decision model.
- a combination of neural network and unsupervised clustering is used to iteratively train the feature extractor to be trained based on the sample image set to obtain an intermediate feature extractor.
- Each iterative training process includes the following steps:
- the feature extractor uses the feature extractor to be trained to extract features from the sample image to obtain a feature set of the sample image. Then cluster the sample image feature set to obtain multi-category sample image features and pseudo labels corresponding to each category of sample image features; based on the obtained multi-category sample image features and the pseudo labels corresponding to each category of sample image features, determine the distribution loss value , and use the distribution loss value to adjust the parameters of the feature extractor to be trained through backpropagation.
- the above-mentioned feature extractor to be trained includes multiple feature extraction layers. After each feature extraction layer performs a feature extraction operation, the output sample image feature set is clustered to obtain multiple image feature groups. The obtained multiple image features are then grouped and input into the next feature extraction layer. Cluster the sample image feature set output by the last feature extraction layer to obtain multi-category sample image features and pseudo labels corresponding to each category of sample image features. Combine the obtained pseudo labels and distribution loss function to obtain the results of this iteration process. Distribution loss value, and then use the distribution loss value of this iteration process to adjust the parameters of the feature extractor to be trained through back propagation, and enter the next iteration process. When the distribution loss value meets the preset convergence condition, or the number of iterations reaches the preset threshold, the training ends and the intermediate feature extractor is obtained.
- the above linear decision model corresponds to specific business scenarios, and different business scenarios correspond to different linear decision models.
- a feature extractor to be trained is constructed.
- the feature extractor is an unsupervised model, defined here as model 1.
- model 1 Based on the text description data of the sample operation behavior, a sample image set is obtained, and the sample image set is input into the unsupervised model for feature extraction, and a sample image feature set is obtained.
- a clustering method is used to perform feature clustering on the sample image feature set to obtain a feature distribution, where the feature distribution includes multiple sample image feature categories and pseudo labels corresponding to each category.
- the distribution loss value is obtained.
- use the distribution loss value to adjust the parameters of the unsupervised model and enter the next iterative training. After multiple iterations of training, an intermediate feature extractor is obtained.
- the method of combining neural network and unsupervised clustering is used, and the abnormal behavior identification model is obtained by merging with the deep model, which effectively solves the problem of randomness of merchants' operating behaviors and differences in merchants' behavioral habits, and reflects it to specific situations. There are also deviations in the data and the problem of being unable to identify samples one by one.
- This application can realize the identification of abnormal behaviors through self-training on the premise of unlabeled data, improving the scope of application of operational behavior recognition.
- pre-train an intermediate feature extractor and then define corresponding linear decision models for different business scenarios, and use the intermediate feature extractor and linear decision model to jointly fine-tune the training to obtain an abnormal behavior recognition model, thereby improving the efficiency of model training. Efficiency also reduces the resource consumption of model training.
- obtaining the risk judgment result of the current operating behavior based on the preliminary risk scores of multiple dimensions includes: performing a weighted sum of the first risk score and the second risk score to obtain the target risk score of the current operating behavior; If the target risk score is greater than the preset threshold, the current operation behavior is determined to be a risky behavior; if the target risk score is less than or equal to the preset threshold, the current operation behavior is determined to be a safe behavior.
- the first risk score is defined as A and the second risk score is defined as B.
- the first risk score and the second risk score are weighted and summed to obtain the target risk score S for the current operating behavior.
- the calculation formula of S is: The following formula (1):
- ⁇ is greater than or equal to 0.7, and ⁇ is less than or equal to 0.3.
- the current operation behavior is determined to be a risky behavior; if the target risk score is less than or equal to the preset threshold, the current operation behavior is determined to be a safe behavior.
- operation behavior 1 is determined to be a risky behavior.
- the relationship between the merchant's operating behavior and usage habits is fully explored to identify whether the merchant's operating behavior is a risky behavior, making full use of the merchant's historical information, broadening the analysis dimension of the merchant's historical information, and improving improve the accuracy of operational behavior recognition.
- the number of times the operation behavior of the target object is determined to be risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.
- the target object After performing a specified number of operational behavior identifications on the target object, count the number of times that the behavior is determined to be risky. If the number is greater than the risk threshold, the target object will be risk marked and warned.
- the server For example, set the judgment period to 24 hours and the risk threshold to 3 times. If within 24 hours, the server performs 10 operational behavior identifications for Merchant 1, and four of them are determined to be risky operational behaviors, then the server will trigger an alarm and risk mark for Merchant 1.
- an embodiment of the present application provides a schematic structural diagram of an operation behavior recognition device, as shown in Figure 5.
- the device 500 includes:
- the acquisition module 501 is used to obtain the text description information of the current operating behavior of the target object, and convert the text description information into an image to be recognized;
- the processing module 502 is used to identify the image to be identified through the trained abnormal behavior recognition model, and obtain preliminary risk scores of the current operating behavior in multiple dimensions;
- the processing module 502 is also configured to obtain the risk judgment result of the current operating behavior based on the preliminary risk scores of the multiple dimensions.
- the acquisition module 501 is specifically used to:
- the text description information of the current operation behavior is collected by the terminal device through the system application framework layer.
- processing module 502 is specifically used to:
- the image to be recognized is obtained based on the operation trajectory and the color attribute of each trajectory point.
- the processing module 502 is specifically used to:
- the text description information also includes pressure information
- mapping the position information into the two-dimensional space and obtaining the operation trajectory it also includes:
- Determining the image to be recognized based on the operation trajectory and the color attribute of each trajectory point includes:
- the image to be recognized is determined based on the operation trajectory, the color attribute of each trajectory point, and the size of each trajectory point.
- processing module 502 is specifically used to:
- the image to be identified is recognized through the trained abnormal behavior recognition model, and the target risk score corresponding to the current operating behavior is obtained, including:
- the target image features are judged to obtain preliminary risk scores of the multiple dimensions.
- processing module 502 is specifically used to:
- the intermediate feature extractor and the linear decision model to be trained are jointly fine-tuned and trained to obtain the trained feature extractor and the trained linear decision model.
- processing module 502 is specifically used to:
- the method uses a combination of neural network and unsupervised clustering to train the feature extractor to be trained and obtain an intermediate feature extractor, including:
- the feature extractor to be trained is iteratively trained based on the sample image set to obtain an intermediate feature extractor.
- Each iterative training process includes the following steps:
- a distribution loss value is determined, and the distribution loss value is used to adjust parameters of the feature extractor to be trained.
- processing module 502 is specifically used to:
- the preliminary risk scores of multiple dimensions include a first risk score and a second risk score, where the first risk score is used to characterize the abnormality of the current operating behavior; the second risk score is used to characterize the current The target similarity between the operation behavior and the historical operation behavior of the target object.
- processing module 502 is specifically used to:
- the preliminary risk score based on the multiple dimensions is used to obtain the risk judgment result of the current operating behavior, including:
- the current operating behavior is determined to be a risky behavior
- the current operation behavior is determined to be a safe behavior.
- processing module 502 is specifically used to:
- the number of times the operation behavior of the target object is determined to be a risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.
- the data is made more intuitive and closer to the monitoring scene, which facilitates the subsequent use of abnormal behavior identification models to self-supervise and identify the operating behavior, determine whether the operating behavior is a risky behavior, and at the same time improve improve the accuracy of operational behavior recognition.
- risky operation behavior policies there is no need to preset risky operation behavior policies to identify merchant operation behaviors, which avoids waste of storage resources and improves the efficiency of operation behavior identification.
- the computer device may be the terminal device or server shown in Figure 1. As shown in Figure 6, it includes at least one processor 601, and at least one processor 601.
- the memory 602 connected to the processor is not limited to the specific connection medium between the processor 601 and the memory 602 in the embodiment of this application.
- the processor 601 and the memory 602 are connected through a bus as an example.
- the bus can be divided into address bus, data bus, control bus, etc.
- the memory 602 stores instructions that can be executed by at least one processor 601. By executing the instructions stored in the memory 602, at least one processor 601 can perform the steps of the above operation behavior identification method.
- the processor 601 is the control center of the computer equipment. It can use various interfaces and lines to connect various parts of the computer equipment, and realize control by running or executing instructions stored in the memory 602 and calling data stored in the memory 602. Risk identification of the current operating behavior of the target object.
- the processor 601 may include one or more processing units.
- the processor 601 may integrate an application processor and a modem processor.
- the application processor mainly processes the operating system, user interface, application programs, etc., and the modem processor
- the debug processor mainly handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 601.
- the processor 601 and the memory 602 can be implemented on the same chip, and in some embodiments, they can also be implemented on separate chips.
- the processor 601 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps and logical block diagrams disclosed in the embodiments of this application.
- a general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.
- the memory 602 can be used to store non-volatile software programs, non-volatile computer executable programs and modules.
- the memory 602 may include at least one type of storage medium, for example, may include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk , CD, etc.
- Memory 602 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer device.
- the memory 602 in the embodiment of the present application can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and/or data.
- embodiments of the present application provide a computer-readable storage medium that stores a computer program that can be executed by a computer device.
- the program is run on the computer device, the computer device is caused to perform the steps of the above operation behavior recognition method. .
- embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
- computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
- These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
- the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
- These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
- Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Multimedia (AREA)
- General Health & Medical Sciences (AREA)
- Health & Medical Sciences (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Software Systems (AREA)
- Medical Informatics (AREA)
- Artificial Intelligence (AREA)
- Computing Systems (AREA)
- Databases & Information Systems (AREA)
- Evolutionary Computation (AREA)
- Business, Economics & Management (AREA)
- Human Computer Interaction (AREA)
- Social Psychology (AREA)
- Psychiatry (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Finance (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- General Business, Economics & Management (AREA)
- Image Analysis (AREA)
Abstract
一种操作行为识别方法及装置,应用在人工智能技术领域,包括:获取目标对象的当前操作行为的文本描述信息,并将文本描述信息转化为待识别图像(S201);通过已训练的异常行为识别模型,对待识别图像进行识别,获得当前操作行为在多个维度的初步风险评分(S202);基于多个维度的初步风险评分,获得当前操作行为的风险判决结果(S203)。将商户操作行为的文本描述信息转化为图像信息,使得数据更直观且更加贴近监控场景,既便于后续采用异常行为识别模型对操作行为进行自监督识别,确定操作行为是否为风险行为,同时提高了操作行为识别的准确性。其次,不需要预设风险操作行为策略来识别商户操作行为,避免存储资源浪费,提高了操作行为识别的效率。
Description
相关申请的交叉引用
本申请要求在2022年08月12日提交中国专利局、申请号为202210972061.9、申请名称为“一种操作行为识别方法及装置”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请涉及人工智能技术领域,尤其涉及一种操作行为识别方法及装置。
为了进一步加强对金融终端全生命周期的安全环境监控与验证能力,和对金融终端的事前事中的动态风险监控能力,需要拓展更广泛的商户操作风险行为的监管方式。
相关技术中,在判断商户的操作行为是否为风险操作行为时,需要提前预设风险操作行为策略,然后根据预设的风险操作行为策略对商户的操作行为进行风险操作行为识别,并计算得到风险操作分值,再根据风险操作分值确定商户的操作行为是否为风险操作行为。
然而,上述方法需要提前预设多种风险操作行为策略并保存,当数据量较大的时候可能存在存储资源消耗较大,以及计算较慢的问题。
发明内容
本申请实施例提供了一种操作行为识别方法及装置,用于提高操作行为识别的效率,降低操作行为识别的资源消耗。
第一方面,本申请实施例提供了一种操作行为识别方法,包括:
获取目标对象的当前操作行为的文本描述信息,并将所述文本描述信息据转化为待识别图像;
通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述当前操作行为在多个维度的初步风险评分;
基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果。
本申请实施例中,通过对商户的操作行为的文本描述信息转化为图像信息,使得数据更直观且更加贴近监控场景,既便于后续采用异常行为识别模型对操作行为进行自监督识别,确定操作行为是否为风险行为,同时提高了操作行为识别的准确性。其次,不需要预设风险操作行为策略,来作为识别商户的操作行为是否为风险操作行为的基准,从而降低了存储资源消耗。并且,当数据量较大时,有效解决因数据量大带来的计算较慢的问题,提高操作行为识别的效率。
可选地,所述当前操作行为的文本描述信息是所述终端设备通过***应用框架层采集获得的。
可选地,所述文本描述信息包括所述当前操作行为的发生时间信息和位置信息。
所述将所述文本描述信息据转化为待识别图像,包括:
将所述位置信息映射至二维空间中,获得操作轨迹:
基于所述发生时间信息,确定所述操作轨迹中每个轨迹点的颜色属性;
基于所述操作轨迹和所述每个轨迹点的颜色属性,获得所述待识别图像。
可选地,所述文本描述信息还包括压力信息;
所述将所述位置信息映射至二维空间中,获得操作轨迹之后,还包括:
基于所述压力信息,确定所述操作轨迹中每个轨迹点的大小;
所述基于所述操作轨迹、所述每个轨迹点的颜色属性,确定所述待识别图像,包括:
基于所述操作轨迹、所述每个轨迹点的颜色属性和所述每个轨迹点的大小,确定所述待识别图像。
可选地,所述已训练的异常行为识别模型包括已训练的特征提取器和已训练的线性判决模型;
通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述多个维度的初步风险评分,包括:
通过所述已训练的特征提取器,对所述待识别图像进行特征提取,获得目标图像特征;
通过所述已训练的线性判决模型,对所述目标图像特征进行判决,获得所述多个维度的初步风险评分。
可选地,所述已训练的异常行为识别模型是采用以下方式训练获得的:
采用神经网络和无监督聚类相结合的方式,对待训练的特征提取器进行训练,获得中间特征提取器;
对所述中间特征提取器和待训练的线性判决模型进行联合微调训练,获得所述已训练的特征提取器和所述已训练的线性判决模型。
可选地,所述采用神经网络和无监督聚类相结合的方式,对待训练的特征提取器进行训练,获得中间特征提取器,包括:
采用神经网络和无监督聚类相结合的方式,基于样本图像集合对待训练的特征提取器进行迭代训练,获得中间特征提取器,其中,每次迭代训练过程,包括以下步骤:
采用待训练的特征提取器,对样本图像进行特征提取,获得样本图像特征集合;
对所述样本图像特征集合进行聚类,获得多类样本图像特征以及每类样本图像特征对应的伪标签;
基于获得的多类样本图像特征以及每类样本图像特征对应的伪标签,确定分布损失值,并采用所述分布损失值,通过反向传播对所述待训练的特征提取器进行参数调整。
可选地,所述多个维度的初步风险评分包括第一风险评分和第二风险评分,其中,第一风险评分用于表征所述当前操作行为的异常程度;所述第二风险评分用于表征所述当前操作行为与所述目标对象的历史操作行为的目标相似度。
可选地,所述基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果,包括:
对所述第一风险评分和所述第二风险评分进行加权求和,获得所述当前操作行为的目标风险评分;
若所述目标风险评分大于预设阈值,则确定所述当前操作行为为风险行为;
若所述目标风险评分小于等于预设阈值,则确定所述当前操作行为为安全行为。
可选地,若在判定周期内,所述目标对象的操作行为被判定为风险行为的次数大于风险阈值,则触发针对所述目标对象的告警和风险标记。
第二方面,本申请实施例提供了一种操作行为识别装置,包括:
获取模块,用于获取目标对象的当前操作行为的文本描述信息,并将所述文本描述信息据转化为待识别图像;
处理模块,用于通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述当前操作行为在多个维度的初步风险评分;
所述处理模块,还用于基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果。
可选地,所述获取模块具体用于:
所述当前操作行为的文本描述信息是所述终端设备通过***应用框架层采集获得的。
可选地,所述处理模块具体用于:
将所述位置信息映射至二维空间中,获得操作轨迹;
基于所述发生时间信息,确定所述操作轨迹中每个轨迹点的颜色属性;
基于所述操作轨迹和所述每个轨迹点的颜色属性,获得所述待识别图像。
可选地,所述处理模块具体用于:
基于所述压力信息,确定所述操作轨迹中每个轨迹点的大小;
所述基于所述操作轨迹、所述每个轨迹点的颜色属性,确定所述待识别图像,包括:
基于所述操作轨迹、所述每个轨迹点的颜色属性和所述每个轨迹点的大小,确定所述待识别图像。
可选地,所述处理模块具体用于:
通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述当前操作行为对应的目标风险评分,包括:
通过所述已训练的特征提取器,对所述待识别图像进行特征提取,获得目标图像特征;
通过所述已训练的线性判决模型,对所述目标图像特征进行判决,获得所述多个维度的初步风险评分。
可选地,所述处理模块具体用于:
采用神经网络和无监督聚类相结合的方式,对待训练的特征提取器进行训练,获得中间特征提取器;
对所述中间特征提取器和待训练的线性判决模型进行联合微调训练,获得所述已训练的特征提取器和所述已训练的线性判决模型。
可选地,所述处理模块具体用于:
采用神经网络和无监督聚类相结合的方式,基于样本图像集合对待训练的特征提取器进行迭代训练,获得中间特征提取器,其中,每次迭代训练过程,包括以下步骤:
采用待训练的特征提取器,对样本图像进行特征提取,获得样本图像特征集合;
对所述样本图像特征集合进行聚类,获得多类样本图像特征以及每类样本图像特征对应的伪标签;
基于获得的多类样本图像特征以及没类样本图像特征对应的伪标签,确定分布损失值,并采用所述分布损失值,通过反向传播对所述待训练的特征提取器进行参数调整。
可选地,所述处理模块具体用于:
所述多个维度的初步风险评分包括第一风险评分和第二风险评分,其中,第一风险评分用于表征所述当前操作行为的异常程度;所述第二风险评分用于表征所述当前操作行为 与所述目标对象的历史操作行为的目标相似度。
可选地,所述处理模块具体用于:
所述基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果,包括:
对所述第一风险评分和所述第二风险评分进行加权求和,获得所述当前操作行为的目标风险评分;
若所述目标风险评分大于预设阈值,则确定所述当前操作行为为风险行为;
若所述目标风险评分小于等于预设阈值,则确定所述当前操作行为为安全行为。
可选地,所述处理模块具体用于:
若在判定周期内,所述目标对象的操作行为被判定为风险行为的次数大于风险阈值,则触发针对所述目标对象的告警和风险标记。
第三方面,本申请实施例提供了一种计算机设备,包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序,所述处理器执行上述第一方面任意所述的操作行为识别方法。
第四方面,本申请实施例提供了一种计算机可读存储介质,其存储有可由计算机设备执行的计算机程序,当所述程序在计算机设备上运行时,使得所述计算机设备执行上述第一方面任意所述的操作行为识别方法。
通过对商户的操作行为的文本描述信息进行形式变换,将商户操作行为的文本描述信息转化为图像信息,使得数据更加直观且更加贴近监控场景,既便于后续采用异常行为识别模型对操作行为进行自监督识别,确定操作行为是否为风险行为,同时提高了操作行为识别的准确性。其次,不需要预设风险操作行为策略,来作为识别商户的操作行为是否为风险操作行为的基准,从而降低了存储资源消耗。并且,当数据量较大时,有效解决因数据量大带来的计算较慢的问题,提高操作行为识别的效率。
为了更清楚地说明本发明实施例中的技术方案,下面将对实施例描述中所需要使用的附图作简要介绍,显而易见地,下面描述中的附图仅仅是本发明的一些实施例,对于本领域的普通技术人员来讲,在不付出创造性劳动性的前提下,还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种***架构示意图;
图2为本发明实施例提供的一种操作行为识别方法的流程示意图;
图3为本发明施例提供的一种文本描述信息据转化为待识别图像的过程示意图;
图4为本发明实施例提供的一种构建异常行为识别模型的过程示意图;
图5为本发明实施例提供的一种操作行为识别装置的结构示意图;
图6为本发明实施例提供的一种计算设备的结构示意图。
为了使本发明的目的、技术方案和优点更加清楚,下面将结合附图对本发明作进一步地详细描述,显然,所描述的实施例仅仅是本发明一部分实施例,而不是全部的实施例。 基于本发明中的实施例,本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例,都属于本发明保护的范围。
参见图1,其为本申请实施例使用的一种***架构图,该***架构包括终端设备101和服务端102,其中,终端设备101用于采集目标对象的当前操作行为的文本描述信息。目标对象可以是商户、用户等;终端设备101可以是智能手机、平板电脑、笔记本电脑、台式计算机、自助取款机、收单设备等,但并不局限于此。
服务端102接收终端设备101发送的当前操作行为的文本描述信息,并基于当前操作行为的文本描述信息,确定当前操作行为的风险判决结果。服务端102可以是独立的物理服务端,也可以是多个物理服务端构成的服务端集群或者分布式***,还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、内容分发网络(Content Delivery Network,CDN)、以及大数据和人工智能平台等基础云计算服务的云服务端。终端设备101和服务端102可以通过有线或无线通信方式进行直接或间接地连接,本申请在此不做限制。
基于上述***架构,图2示例性的示出了一种操作行为识别方法的流程,该方法的流程由计算机设备执行,计算及设备可以是图1所示的服务端,包括以下步骤:
步骤S201,获取目标对象的当前操作行为的文本描述信息,并将文本描述信息据转化为待识别图像;
具体地,目标对象可以为商户,当前操作行为为商户当前正在与终端设备进行的交互操作,其中,交互操作包括但不限于点击、双击、互动等。文本描述信息为描述交互操作的文本序列。服务端将当前操作行为产生的文本描述信息进行转化,得到待识别图像。
在一些实施例中,文本描述信息包括当前操作行为的发生时间信息和位置信息。那么将文本描述信息据转化为待识别图像的过程为:将位置信息映射至二维空间中,获得操作轨迹;基于发生时间信息,确定操作轨迹中每个轨迹点的颜色属性;基于操作轨迹和每个轨迹点的颜色属性,获得待识别图像。
具体地,如图3所示,商户在终端设备的屏幕上触发多个交互操作事件,终端设备采集交互操作事件对应的操作行为的文本描述信息,每个操作行为都有相应的发生时间信息和位置信息。终端设备将每个操作行为的发生时间信息和位置信息发送至服务端。服务端对发生时间信息和位置信息的数据格式进行转换,获得具体时间和位置坐标点。服务端将获得的位置坐标点进行空间转换,获得操作轨迹;将具体时间进行空间转换,获得操作轨迹上每个轨迹点的颜色属性。结合操作轨迹以及操作轨迹上的每个操作点的颜色属性,得到二维待识别图像。
在一些实施例中,操作轨迹包括点和/或线。举例来说,若商户的单次操作为“点击”,则该“点击”操作在二维空间上对应的操作轨迹为一个点;若商户的操作为“滑动”,则该“滑动”操作在二维空间上对应的操作轨迹为一条线,这条线是由无数个轨迹点构成。
在一些实施例中,颜色属性用于表征操作轨迹的时间先后顺序,颜色属性可以是颜色深度或者颜色类型。
举例来说,商户在收单设备的屏幕上触发从右往左的滑动事件,则在服务端生成的待识别图像中包括一条横向的操作轨迹,该操作轨迹由无数个轨迹点组成。定义每个轨迹点的颜色种类为红色,且从右到左连续的轨迹点颜色深度逐渐变浅,以此来表征商户的操作行为是从右至左执行的。也可以定义该操作轨迹的每个轨迹点的颜色种类为蓝色,且从右 到左连续的轨迹点颜色深度逐渐变深,以此来表征商户的操作行为是从右至左执行的。
在一些实施例中,文本描述信息还包括压力信息。将位置信息映射至二维空间中,获得操作轨迹之后,基于压力信息,确定操作轨迹中每个轨迹点的大小,然后基于操作轨迹、每个轨迹点的颜色属性和每个轨迹点的大小,确定待识别图像。
具体地,压力信息指操作时按压屏幕的压力值。商户在终端设备的屏幕上触发多个交互操作事件,终端设备采集交互操作事件对应的操作行为的文本描述信息,每个操作行为都有相应的发生时间信息、位置信息和压力信息。终端设备将每个操作行为的发生时间信息、位置信息和压力信息发送至服务端。服务端对发生时间信息、位置信息和压力信息的数据格式进行转换,获得具体时间、位置坐标点和按压压力值。服务端将获得的位置坐标点进行空间转换,获得操作轨迹;将具体时间进行空间转换,获得操作轨迹上每个轨迹点的颜色属性;将按压压力值进行空间转换,获得操作轨迹上每个轨迹点的大小。结合操作轨迹、操作轨迹上的每个操作点的颜色属性和操作轨迹上每个轨迹点的大小,得到二维待识别图像,其中,操作轨迹上每个轨迹点的大小,可以体现出商户操作的习惯。当操作轨迹为一条线时,操作轨迹上多个轨迹点的大小,可对应到操作轨迹的粗细程度。不同商户进行相同的操作行为时,若操作行为的文本描述信息中的压力信息不同,则对应产生的操作轨迹的粗细程度也不相同。
举例来说,商户A在收单设备的屏幕上触发从右往左的滑动事件,则在服务端生成的待识别图像中包括一条横向的操作轨迹,该操作轨迹为红色,从右到左颜色逐渐变浅,且该操作轨迹较粗;
商户B在收单设备的屏幕上触发从右往左的滑动事件,则在服务端生成的待识别图像中包括一条横向的操作轨迹,该操作轨迹为蓝色,从右到左颜色逐渐变浅,且该操作轨迹较细。
本申请实施例中,将商户操作行为的文本描述信息转化为图像信息,使得数据更直观且更加贴近监控场景,既便于后续采用异常行为识别模型对操作行为进行自监督识别,确定操作行为是否为风险行为,同时提高了操作行为识别的准确性。
在一些实施例中,当前操作行为的文本描述信息是终端设备通过***应用框架层采集获得的。
具体地,终端设备通过连接应用框架层的相关接口,开启数据采集功能。
例如,当商户操作收单设备时,收单设备自动采集商户当前操作行为的文本描述信息,包括操作事件发生时间、操作点击位置的相关信息,然后将采集的操作信息先暂存至收单设备的内存中,随后以消息队列的形式将操作信息发送至服务端进行数据的解析和处理。
本申请实施例中,以安卓***底层的获取事件的方式来采集商户的操作行为数据,将数据源聚焦于底层输入事件上,该方式不需要提前嵌入采样软件开发工具包(Software Development Kit,简称SDK)植入监控服务,便可以监控商户在设备上的任何操作,具有更广泛的适用性。该方法包括且不限于***属性设置操作、收单操作以及其他App操作等,因此对于商户侧监控***工程化落地具有一定的可行性。
步骤S202,通过已训练的异常行为识别模型,对待识别图像进行识别,获得当前操作行为在多个维度的初步风险评分;
具体地,将二维的待识别图像输入异常行为识别模型,使用该异常行为识别模型对该二维的待识别图像进行识别,获得当前操作行为在多个维度的初步风险评分。
在一些实施例中,多个维度的初步风险评分包括第一风险评分和第二风险评分,其中,第一风险评分用于表征当前操作行为的异常程度,第二风险评分用于表征当前操作行为与目标对象的历史操作行为的目标相似度。
具体地,已训练的异常行为识别模型根据当前操作行为的异常程度给出第一风险评分,风险程度越高,异常行为识别模型给出的风险评分越高。其中,自动化操作、高频重复操作等均是风险程度较高的操作行为,相应会给出较高的风险评分。
已训练的异常行为识别模型还会根据当前操作行为与目标对象的历史操作行为的目标相似度进行评分,获得第二风险评分,其中,当前操作行为与历史操作行为的目标相似度越高,说明当前操作行为法越可能是正常的,因此异常行为识别模型给出的第二风险评分越低。当前操作行为与历史操作行为的目标相似度越低,则说明当前操作行为可能发生异常,则异常行为识别模型给出的第二风险评分越低。
通过该异常行为识别模型建立了使用习惯与操作行为之间的联系,能进行纵向识别,通过分析商户的设备使用习惯及单次操作行为来判定设备是否存在异常的情况,充分利用商户的历史信息的分析维度,有效识别非本人操作情况,达到对目标进行合规管控的目的。
步骤S203,基于多个维度的初步风险评分,获得当前操作行为的风险判决结果。
具体地,若当前操作行为的多个维度的初步风险评分,满足风险判决条件,则判定当前操作行为为风险操作行为,相反,则判定当前操作行为为安全操作行为。
将商户操作行为的文本描述信息转化为图像信息,使得数据更直观且更加贴近监控场景,既便于后续采用异常行为识别模型对操作行为进行自监督识别,确定操作行为是否为风险行为,同时提高了操作行为识别的准确性。其次,不需要预设风险操作行为策略来识别商户操作行为,避免存储资源浪费,提高了操作行为识别的效率。
在上述步骤S202中,已训练的异常行为识别模型包括已训练的特征提取器和已训练的线性判决模型。通过已训练的异常行为识别模型,对待识别图像进行识别,获得当前操作行为对应的目标风险评分,包括:
通过已训练的特征提取器,对待识别图像进行特征提取,获得目标图像特征;通过已训练的线性判决模型,对目标图像特征进行判决,获得多个维度的初步风险评分。
具体地,异常行为识别模型包含特征提取器和线性判决模型,特征提取器可对待识别二维图像进行特征提取,获得目标图像特征。线性判决模型与具体的业务场景对应,用于判决输出相应的业务场景下,当前操作行为在多个维度的初步风险评分。
在一些实施例中,已训练的异常行为识别模型是采用以下方式训练获得的:
采用神经网络和无监督聚类相结合的方式,对待训练的特征提取器进行训练,获得中间特征提取器。对中间特征提取器和待训练的线性判决模型进行联合微调训练,获得已训练的特征提取器和已训练的线性判决模型。
具体地,采用神经网络和无监督聚类相结合的方式,基于样本图像集合对待训练的特征提取器进行迭代训练,获得中间特征提取器,其中,每次迭代训练过程,包括以下步骤:
采用待训练的特征提取器,对样本图像进行特征提取,获得样本图像特征集合。然后对样本图像特征集合进行聚类,获得多类样本图像特征以及每类样本图像特征对应的伪标签;基于获得的多类样本图像特征以及每类样本图像特征对应的伪标签,确定分布损失值,并采用分布损失值,通过反向传播对待训练的特征提取器进行参数调整。
上述待训练的特征提取器包括多个特征提取层,其中,每个特征提取层执行特征提取 操作后,将输出的样本图像特征集合进行聚类,获得多个图像特征分组。然后将获得的多个图像特征分组输入下一个特征提取层。对最后一个特征提取层输出的样本图像特征集合进行聚类,获得多类样本图像特征以及每类样本图像特征对应的伪标签,并结合获得的伪标签和分布损失函数,获得此次迭代过程的分布损失值,再采用此次迭代过程的分布损失值,通过反向传播对待训练的特征提取器进行参数调整,并进入下一个迭代过程。当分布损失值满足预设收敛条件,或者迭代次数达到预设阈值时,结束训练,获得中间特征提取器。
上述线性判决模型与具体的业务场景对应,不同的业务场景对应不同的线性判决模型。针对不同的业务场景,只需要在小批量图像样本对中间特征提取器和相应的待训练的线性判决模型进行联合微调训练,获得已训练的特征提取器和已训练的线性判决模型。
举例来说,如图4所示,构建待训练的特征提取器,该特征提取器为无监督模型,此处定义为model 1。基于样本操作行为的文本描述数据,获得样本图像集合,将样本图像集合输入无监督模型进行特征提取,获得样本图像特征集合。然后采用聚类方式对样本图像特征集合进行特征聚类,获得特征分布,其中,特征分布包括多个样本图像特征类别以及每个类别对应的伪标签。基于获得的伪标签和分布损失函数,获得分布损失值。然后采用分布损失值对无监督模型进行参数调整,并进入下一次迭代训练。在多个迭代训练之后,获得中间特征提取器。
针对特定业务场景,在model 1上定义一个待训练的线性判决模型,将该待训练的线性判决模型定义为model 2,采用小批量图像样本对model 1和model 2进行联合微调训练,结合具体业务场景对模型的整体识别效果进行微调,得到已训练的异常行为识别模型。
采用神经网络和无监督聚类相结合方法,并通过和深度模型相融合的方式获得异常行为识别模型,有效解决了因商户的操作行为的随机性以及商户行为习惯的差异性,反映到具体的数据也上存在偏差,而无法对样本一一标识的问题,本申请可以实现在无标签数据的前提下,依然能够通过自训练识别异常行为,提高了操作行为识别的适用范围。其次,预先训练一个中间特征提取器,然后针对不同的业务场景,定义相应的线性判决模型,并采用中间特征提取器和线性判决模型联合微调训练即可获得异常行为识别模型,从而提高模型训练的效率,也降低了模型训练的资源消耗。
在一些实施例中,基于多个维度的初步风险评分,获得当前操作行为的风险判决结果,包括:对第一风险评分和第二风险评分进行加权求和,获得当前操作行为的目标风险评分;若目标风险评分大于预设阈值,则确定当前操作行为为风险行为;若目标风险评分小于等于预设阈值,则确定当前操作行为为安全行为。
具体地,将第一风险评分定义为A,第二风险评分定义为B,对第一风险评分和第二风险评分进行加权求和,得到当前操作行为的目标风险评分S,S的计算公式为以下公式(1):
S=α*A+β*B…………..(1)
其中,α大于等于0.7,β小于等于0.3。
若目标风险评分大于预设阈值,则确定当前操作行为为风险行为;若目标风险评分小于等于预设阈值,则确定当前操作行为为安全行为。
举例来说,设定采集的商户的当前操作行为为操作行为1,采用已训练的异常行为识别模型确定操作行为1的第一风险评分为80分,第二风险评分为35分;设定α为0.7,β为0.3,则采用上述公式(1)可以获知,操作行为1的目标风险评分S为66.5分。
若预设阈值为65分,由于操作行为1的目标风险评分S大于预设阈值,则确定操作行为1为风险行为。
本申请实施例中,充分挖掘商户的操作行为与使用习惯之间的关系,来识别商户的操作行为是否为风险行为,充分利用了商户的历史信息,拓宽了对商户历史信息的分析维度,提高了操作行为识别的准确性。
在一些实施例中,若在判定周期内,目标对象的操作行为被判定为风险行为的次数大于风险阈值,则触发针对目标对象的告警和风险标记。
具体地,预先设置在判定周期内进行指定次数的操作行为识别。在针对目标对象执行指定次数的操作行为识别之后,统计被判定为风险行为的次数。若次数大于风险阈值,则对目标对象进行风险标记和警告。
举例来说,设定判定周期为24小时,风险阈值为3次。若在24小时内,服务端针对商户1执行了10次操作行为识别,其中,四次操作行为被判定为风险操作行为,那么服务端触发针对商户1的告警和风险标记。
本申请实施例中,通过对商户进行警告和风险标记,达到对商户操作行为进行合规管控的目的,为商户与机构的分级预警与管理提供参考。
基于相同的技术构思,本申请实施例提供一种操作行为识别装置结构示意图,如图5所示,该装置500包括:
获取模块501,用于获取目标对象的当前操作行为的文本描述信息,并将所述文本描述信息据转化为待识别图像;
处理模块502,用于通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述当前操作行为在多个维度的初步风险评分;
所述处理模块502,还用于基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果。
可选地,所述获取模块501具体用于:
所述当前操作行为的文本描述信息是所述终端设备通过***应用框架层采集获得的。
可选地,所述处理模块502具体用于:
将所述位置信息映射至二维空间中,获得操作轨迹;
基于所述发生时间信息,确定所述操作轨迹中每个轨迹点的颜色属性;
基于所述操作轨迹和所述每个轨迹点的颜色属性,获得所述待识别图像。可选地,所述处理模块502具体用于:
所述文本描述信息还包括压力信息;
所述将所述位置信息映射至二维空间中,获得操作轨迹之后,还包括:
基于所述压力信息,确定所述操作轨迹中每个轨迹点的大小;
所述基于所述操作轨迹、所述每个轨迹点的颜色属性,确定所述待识别图像,包括:
基于所述操作轨迹、所述每个轨迹点的颜色属性和所述每个轨迹点的大小,确定所述待识别图像。
可选地,所述处理模块502具体用于:
通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述当前操作行为对应的目标风险评分,包括:
通过所述已训练的特征提取器,对所述待识别图像进行特征提取,获得目标图像特征;
通过所述已训练的线性判决模型,对所述目标图像特征进行判决,获得所述多个维度的初步风险评分。
可选地,所述处理模块502具体用于:
采用神经网络和无监督聚类相结合的方式,对待训练的特征提取器进行训练,获得中间特征提取器;
对所述中间特征提取器和待训练的线性判决模型进行联合微调训练,获得所述已训练的特征提取器和所述已训练的线性判决模型。
可选地,所述处理模块502具体用于:
所述采用神经网络和无监督聚类相结合的方式,对待训练的特征提取器进行训练,获得中间特征提取器,包括:
采用神经网络和无监督聚类相结合的方式,基于样本图像集合对待训练的特征提取器进行迭代训练,获得中间特征提取器,其中,每次迭代训练过程,包括以下步骤:
采用待训练的特征提取器,对样本图像进行特征提取,获得样本图像特征集合;
对所述样本图像特征集合进行聚类,获得多类样本图像特征以及每类样本图像特征对应的伪标签;
基于获得的伪标签,确定分布损失值,并采用所述分布损失值对所述待训练的特征提取器进行参数调整。
可选地,所述处理模块502具体用于:
所述多个维度的初步风险评分包括第一风险评分和第二风险评分,其中,第一风险评分用于表征所述当前操作行为的异常程度;所述第二风险评分用于表征所述当前操作行为与所述目标对象的历史操作行为的目标相似度。
可选地,所述处理模块502具体用于:
所述基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果,包括:
对所述第一风险评分和所述第二风险评分进行加权求和,获得所述当前操作行为的目标风险评分;
若所述目标风险评分大于预设阈值,则确定所述当前操作行为为风险行为;
若所述目标风险评分小于等于预设阈值,则确定所述当前操作行为为安全行为。
可选地,所述处理模块502具体用于:
若在判定周期内,所述目标对象的操作行为被判定为风险行为的次数大于风险阈值,则触发针对所述目标对象的告警和风险标记。
通过将商户操作行为的文本描述信息转化为图像信息,使得数据更直观且更加贴近监控场景,既便于后续采用异常行为识别模型对操作行为进行自监督识别,确定操作行为是否为风险行为,同时提高了操作行为识别的准确性。其次,不需要预设风险操作行为策略来识别商户操作行为,避免存储资源浪费,提高了操作行为识别的效率。
基于相同的技术构思,本申请实施例提供了一种计算机设备,该计算机设备可以是图1所示的终端设备或者服务端,如图6所示,包括至少一个处理器601,以及与至少一个处理器连接的存储器602,本申请实施例中不限定处理器601与存储器602之间的具体连接介质,图6中处理器601和存储器602之间通过总线连接为例。总线可以分为地址总线、数据总线、控制总线等。
在本申请实施例中,存储器602存储有可被至少一个处理器601执行的指令,至少一个处理器601通过执行存储器602存储的指令,可以执行上述操作行为识别方法的步骤。
其中,处理器601是计算机设备的控制中心,可以利用各种接口和线路连接计算机设备的各个部分,通过运行或执行存储在存储器602内的指令以及调用存储在存储器602内的数据,从而实现对目标对象当前操作行为的风险识别。可选的,处理器601可包括一个或多个处理单元,处理器601可集成应用处理器和调制解调处理器,其中,应用处理器主要处理操作***、用户界面和应用程序等,调制解调处理器主要处理无线通信。可以理解的是,上述调制解调处理器也可以不集成到处理器601中。在一些实施例中,处理器601和存储器602可以在同一芯片上实现,在一些实施例中,它们也可以在独立的芯片上分别实现。
处理器601可以是通用处理器,例如中央处理器(CPU)、数字信号处理器、专用集成电路(Application Specific Integrated Circuit,ASIC)、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件,可以实现或者执行本申请实施例中公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成,或者用处理器中的硬件及软件模块组合执行完成。
存储器602作为一种非易失性计算机可读存储介质,可用于存储非易失性软件程序、非易失性计算机可执行程序以及模块。存储器602可以包括至少一种类型的存储介质,例如可以包括闪存、硬盘、多媒体卡、卡型存储器、随机访问存储器(Random Access Memory,RAM)、静态随机访问存储器(Static Random Access Memory,SRAM)、可编程只读存储器(Programmable Read Only Memory,PROM)、只读存储器(Read Only Memory,ROM)、带电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory,EEPROM)、磁性存储器、磁盘、光盘等等。存储器602是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机设备存取的任何其他介质,但不限于此。本申请实施例中的存储器602还可以是电路或者其它任意能够实现存储功能的装置,用于存储程序指令和/或数据。
基于同一发明构思,本申请实施例提供了一种计算机可读存储介质,其存储有可由计算机设备执行的计算机程序,当程序在计算机设备上运行时,使得计算机设备执行上述操作行为识别方法的步骤。
本领域内的技术人员应明白,本申请的实施例可提供为方法、***、或计算机程序产品。因此,本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且,本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器,使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方 式工作的计算机可读存储器中,使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品,该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上,使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理,从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然,本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样,倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内,则本申请也意图包含这些改动和变型在内。
Claims (13)
- 一种操作行为识别方法,其特征在于,包括:获取目标对象的当前操作行为的文本描述信息,并将所述文本描述信息据转化为待识别图像;通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述当前操作行为在多个维度的初步风险评分;基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果。
- 如权利要求1所述的方法,其特征在于,所述当前操作行为的文本描述信息是所述终端设备通过***应用框架层采集获得的。
- 如权利要求1所述的方法,其特征在于,所述文本描述信息包括所述当前操作行为的发生时间信息和位置信息;所述将所述文本描述信息据转化为待识别图像,包括:将所述位置信息映射至二维空间中,获得操作轨迹;基于所述发生时间信息,确定所述操作轨迹中每个轨迹点的颜色属性;基于所述操作轨迹和所述每个轨迹点的颜色属性,获得所述待识别图像。
- 如权利要求3所述的方法,其特征在于,所述文本描述信息还包括压力信息;所述将所述位置信息映射至二维空间中,获得操作轨迹之后,还包括:基于所述压力信息,确定所述操作轨迹中每个轨迹点的大小;所述基于所述操作轨迹、所述每个轨迹点的颜色属性,确定所述待识别图像,包括:基于所述操作轨迹、所述每个轨迹点的颜色属性和所述每个轨迹点的大小,确定所述待识别图像。
- 如权利要求1所述的方法,其特征在于,所述已训练的异常行为识别模型包括已训练的特征提取器和已训练的线性判决模型;通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述多个维度的初步风险评分,包括:通过所述已训练的特征提取器,对所述待识别图像进行特征提取,获得目标图像特征;通过所述已训练的线性判决模型,对所述目标图像特征进行判决,获得所述多个维度的初步风险评分。
- 如权利要求5所述的方法,其特征在于,所述已训练的异常行为识别模型是采用以下方式训练获得的:采用神经网络和无监督聚类相结合的方式,对待训练的特征提取器进行训练,获得中间特征提取器;对所述中间特征提取器和待训练的线性判决模型进行联合微调训练,获得所述已训练的特征提取器和所述已训练的线性判决模型。
- 如权利要求6所述的方法,其特征在于,所述采用神经网络和无监督聚类相结合的方式,对待训练的特征提取器进行训练,获得中间特征提取器,包括:采用神经网络和无监督聚类相结合的方式,基于样本图像集合对待训练的特征提取器进行迭代训练,获得中间特征提取器,其中,每次迭代训练过程,包括以下步骤:采用待训练的特征提取器,对样本图像进行特征提取,获得样本图像特征集合;对所述样本图像特征集合进行聚类,获得多类样本图像特征以及每类样本图像特征对应的伪标签;基于获得的多类样本图像特征以及每类样本图像特征对应的伪标签,确定分布损失值,并采用所述分布损失值,通过反向传播对所述待训练的特征提取器进行参数调整。
- 如权利要求1至7任一所述的方法,其特征在于,所述多个维度的初步风险评分包括第一风险评分和第二风险评分,其中,第一风险评分用于表征所述当前操作行为的异常程度;所述第二风险评分用于表征所述当前操作行为与所述目标对象的历史操作行为的目标相似度。
- 如权利要求8所述的方法,其特征在于,所述基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果,包括:对所述第一风险评分和所述第二风险评分进行加权求和,获得所述当前操作行为的目标风险评分;若所述目标风险评分大于预设阈值,则确定所述当前操作行为为风险行为;若所述目标风险评分小于等于预设阈值,则确定所述当前操作行为为安全行为。
- 如权利要求9所述的方法,其特征在于,若在判定周期内,所述目标对象的操作行为被判定为风险行为的次数大于风险阈值,则触发针对所述目标对象的告警和风险标记。
- 一种操作行为识别装置,其特征在于,包括:获取模块,用于获取目标对象的当前操作行为的文本描述信息,并将所述文本描述信息据转化为待识别图像;处理模块,用于通过已训练的异常行为识别模型,对所述待识别图像进行识别,获得所述当前操作行为在多个维度的初步风险评分;所述处理模块,还用于基于所述多个维度的初步风险评分,获得所述当前操作行为的风险判决结果。
- 一种计算机设备,包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序,其特征在于,所述处理器执行所述程序时实现权利要求1~10任一所述的方法的步骤。
- 一种计算机可读存储介质,其特征在于,其存储有可由计算机设备执行的计算机程序,当所述程序在计算机设备上运行时,使得所述计算机设备执行权利要求1~10任一所述的方法的步骤。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210972061.9 | 2022-08-12 | ||
CN202210972061.9A CN115439928A (zh) | 2022-08-12 | 2022-08-12 | 一种操作行为识别方法及装置 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2024031881A1 true WO2024031881A1 (zh) | 2024-02-15 |
Family
ID=84241723
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2022/136238 WO2024031881A1 (zh) | 2022-08-12 | 2022-12-02 | 一种操作行为识别方法及装置 |
Country Status (3)
Country | Link |
---|---|
CN (1) | CN115439928A (zh) |
TW (1) | TWI835478B (zh) |
WO (1) | WO2024031881A1 (zh) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN116720181A (zh) * | 2023-05-06 | 2023-09-08 | 武汉优尼思科技有限公司 | 应对智慧数字服务的可视化操作风险预测方法及软件产品 |
Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110046781A (zh) * | 2018-12-04 | 2019-07-23 | 阿里巴巴集团控股有限公司 | 商户风险防控方法及装置 |
US20190303728A1 (en) * | 2018-03-27 | 2019-10-03 | Alibaba Group Holding Limited | Risky transaction identification method and apparatus |
CN110399925A (zh) * | 2019-07-26 | 2019-11-01 | 腾讯科技(武汉)有限公司 | 账号的风险识别方法、装置及存储介质 |
CN111913860A (zh) * | 2020-07-15 | 2020-11-10 | 中国民航信息网络股份有限公司 | 一种操作行为分析方法及装置 |
CN112288831A (zh) * | 2020-10-29 | 2021-01-29 | 中国人民解放军陆军装甲兵学院 | 基于生成对抗网络的场景图像生成方法和装置 |
CN112906617A (zh) * | 2021-03-08 | 2021-06-04 | 济南大学 | 一种基于手部检测的驾驶员异常行为识别方法与*** |
CN112926699A (zh) * | 2021-04-25 | 2021-06-08 | 恒生电子股份有限公司 | 异常对象识别方法、装置、设备及存储介质 |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
TW200921542A (en) * | 2007-11-08 | 2009-05-16 | Syscom Comp Engineering Co | Security management and detection systems and methods for financial transactions |
US20190279218A1 (en) * | 2014-08-08 | 2019-09-12 | Brighterion, Inc. | Behavior tracking smart agents for artificial intelligence fraud protection and management |
CN106445387A (zh) * | 2016-09-30 | 2017-02-22 | 上海斐讯数据通信技术有限公司 | 一种触屏终端的解锁方法及*** |
TWI730473B (zh) * | 2019-10-25 | 2021-06-11 | 中國信託商業銀行股份有限公司 | 金融服務系統及警示方法 |
-
2022
- 2022-08-12 CN CN202210972061.9A patent/CN115439928A/zh active Pending
- 2022-12-02 WO PCT/CN2022/136238 patent/WO2024031881A1/zh unknown
- 2022-12-21 TW TW111149156A patent/TWI835478B/zh active
Patent Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20190303728A1 (en) * | 2018-03-27 | 2019-10-03 | Alibaba Group Holding Limited | Risky transaction identification method and apparatus |
CN110046781A (zh) * | 2018-12-04 | 2019-07-23 | 阿里巴巴集团控股有限公司 | 商户风险防控方法及装置 |
CN110399925A (zh) * | 2019-07-26 | 2019-11-01 | 腾讯科技(武汉)有限公司 | 账号的风险识别方法、装置及存储介质 |
CN111913860A (zh) * | 2020-07-15 | 2020-11-10 | 中国民航信息网络股份有限公司 | 一种操作行为分析方法及装置 |
CN112288831A (zh) * | 2020-10-29 | 2021-01-29 | 中国人民解放军陆军装甲兵学院 | 基于生成对抗网络的场景图像生成方法和装置 |
CN112906617A (zh) * | 2021-03-08 | 2021-06-04 | 济南大学 | 一种基于手部检测的驾驶员异常行为识别方法与*** |
CN112926699A (zh) * | 2021-04-25 | 2021-06-08 | 恒生电子股份有限公司 | 异常对象识别方法、装置、设备及存储介质 |
Also Published As
Publication number | Publication date |
---|---|
CN115439928A (zh) | 2022-12-06 |
TWI835478B (zh) | 2024-03-11 |
TW202407578A (zh) | 2024-02-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP6771751B2 (ja) | リスク評価方法およびシステム | |
US20180322394A1 (en) | Analyzing sequence data using neural networks | |
CN110806954B (zh) | 评估云主机资源的方法、装置、设备及存储介质 | |
WO2019218699A1 (zh) | 欺诈交易判断方法、装置、计算机设备和存储介质 | |
WO2021103868A1 (zh) | 一种行人结构化方法、装置、设备和存储介质 | |
WO2017133188A1 (zh) | 一种特征集确定的方法及装置 | |
US20190311114A1 (en) | Man-machine identification method and device for captcha | |
CN111652290B (zh) | 一种对抗样本的检测方法及装置 | |
JP2022141931A (ja) | 生体検出モデルのトレーニング方法及び装置、生体検出の方法及び装置、電子機器、記憶媒体、並びにコンピュータプログラム | |
CN111444956B (zh) | 低负载信息预测方法、装置、计算机***及可读存储介质 | |
CN109871686A (zh) | 基于图标表示和软件行为一致性分析的恶意程序识别方法及装置 | |
WO2024031881A1 (zh) | 一种操作行为识别方法及装置 | |
US20230004979A1 (en) | Abnormal behavior detection method and apparatus, electronic device, and computer-readable storage medium | |
US20210174104A1 (en) | Finger vein comparison method, computer equipment, and storage medium | |
WO2024098699A1 (zh) | 实体对象的威胁检测方法、装置、设备及存储介质 | |
CN111723815A (zh) | 模型训练方法、图像处理方法、装置、计算机***和介质 | |
CN112424784A (zh) | 用于使用神经网络的改进的表标识的***、方法和计算机可读介质 | |
CN109754077B (zh) | 深度神经网络的网络模型压缩方法、装置及计算机设备 | |
CN117196630A (zh) | 交易风险预测方法、装置、终端设备以及存储介质 | |
US11823066B2 (en) | Enterprise market volatility predictions through synthetic DNA and mutant nucleotides | |
CN112347102B (zh) | 多表拼接方法和多表拼接装置 | |
CN114444514A (zh) | 语义匹配模型训练、语义匹配方法及相关装置 | |
CN113887862A (zh) | 一种能源计量业务数据分析方法和*** | |
US20230237150A1 (en) | Structured data flow identification for proactive issue detection | |
US11823065B2 (en) | Enterprise market volatility predictions through synthetic DNA and mutant nucleotides |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 22954819 Country of ref document: EP Kind code of ref document: A1 |